CVE-2026-119675

The record

MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a restore to create an unauthorized user-chosen database account, including an account with the root role. Exploitation requires an operator to restore unauthorized user-controlled data using credentials with sufficient user-management privileges on the destination deployment. Excluding the admin namespace alone does not prevent this behavior. This issue affects MongoDB Database Tools versions 100.4.0 through versions before 100.20.1.

Affected packages

Related vulnerabilities

• CVE-2026-121200 Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38… CWE-706
• CVE-2026-121133 Incorrect reference resolution in Images in Google Chrome on on Mac prior to… CWE-706
• CVE-2026-118938 In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted… CWE-706
• CVE-2026-119270 Incorrect reference resolution in CacheStorage in Google Chrome prior to 156.0.8078.79… CWE-706
• CVE-2026-119266 Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a… CWE-706
• CVE-2026-119265 Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a… CWE-706
• CVE-2026-118314 Incorrect reference resolution in UI in Google Chrome on on Android prior to… CWE-706
• CVE-2026-118309 Incorrect reference resolution in UI in Google Chrome on on Android prior to… CWE-706